Re: [PATCH 4/4] fs: Fix possible use-after-free with AIO

[Jeff Moyer <jmoyer@redhat.com>]

Jan Kara <jack@suse.cz> writes:

> Running AIO is pinning inode in memory using file reference. Once AIO
> is completed using aio_complete(), file reference is put and inode can
> be freed from memory. So we have to be sure that calling aio_complete()
> is the last thing we do with the inode.
>
> CC: Christoph Hellwig <hch@infradead.org>
> CC: Jens Axboe <axboe@kernel.dk>
> CC: Jeff Moyer <jmoyer@redhat.com>
> CC: stable@vger.kernel.org
> Signed-off-by: Jan Kara <jack@suse.cz>
> ---
>  fs/direct-io.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/fs/direct-io.c b/fs/direct-io.c
> index cf5b44b..f853263 100644
> --- a/fs/direct-io.c
> +++ b/fs/direct-io.c
> @@ -261,9 +261,9 @@ static ssize_t dio_complete(struct dio *dio, loff_t offset, ssize_t ret, bool is
>  		dio->end_io(dio->iocb, offset, transferred,
>  			    dio->private, ret, is_async);
>  	} else {
> +		inode_dio_done(dio->inode);
>  		if (is_async)
>  			aio_complete(dio->iocb, ret, 0);
> -		inode_dio_done(dio->inode);
>  	}

OK, so this is only a problem if nobody is waiting in inode_dio_wait,
yes?  Good catch, though it seems incredibly unlikely anyone would trip
over this in practice (since fput is done in a worker thread, or
deferred).

Acked-by: Jeff Moyer <jmoyer@redhat.com>